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(c) 1963 "Where the Wild Things Are," by Vlaurice Sendak 




• Master's student in Computer Science with a focus in 
information security @ the University of Illinois Urbana- 
Champaign 


• Research: privacy, usability of encryption, legal and policy 
issues surrounding technology and information security 



OBLIGATORY DISCLAIMER 


• I am not your lawyer. 

• This presentation is not legal advice. 

• With that beina said... 



WHAT I PLAN TC 

The Issues & Background — 


1st Amendment 


4th Amendment 


Probable cause & encryption 


5th Amendment 


• Self-incrimination 
• All Writs Act 

• Research on use of encryption 
Backdoor access 


Going Forward 
Questions (hopefully) 


COVER 



article I 

£nngrr\N shall nuke no bw respecting an establishment 
of religion, or prohibiting the free exercise thereof; or 
abridging the freedom of speech, or of the press; or the 
right of the people peaceably to assemble, and to peti- 
tion the Government for a redress of grievances. 

article II 

a well regulated Militia, being necessary to the security 
of a free State, the right of the people to keep and bear 
Arms, shall not be infringed. 

article III 

B o Soldier shall, in time of peace be quartered in any 
house, without the consent of the Owner, nor in time of 
war, but in a manner to be prescribed by bw. 

article IV 

*thc right of the people to be secure in their persons, 
houses, papers, and effects, against unreasonable searches 
and seizures, shall not be violated, and no Warrants shall 
issue, but upon probable cause, supported by Oath or 
affirmation, and particularly describing the place to be 
searched, and the persons or things to be seized. 

article v 

B o person shall be held to answer for a capital, or 
otherwise infamous crime, unless on a presentment or 
indictment of a Grand Jury, except in cases arising in 
the bnd or naval forces, or in the Militia, when in actual 
service in time of War or public danger, nor shall any 
person be subject for the same offence to be twice put 
in jeopardy of life or limb; nor shall be compelled in any 
Criminal Case to be a witness against himself, nor be 


deprived of life, liberty', or property, without due proc- 
ess of bw; nor shall private property be taken for public 
use, without just compensation. 

article vi 

3n all criminal prosecutions, the accused shall enjoy the 
right to a speedy and public trial, by an impartial jury 
of the State and district wherein the crime shall have 
been committed, which district shall have been previ- 
ously ascertained by bw, and to be informed of the 
nature and cause of the accusation; to be confronted 
with the witnesses against him; to have compulsory 
process for obtaining Witnesses in his favor, and to have 
the Assistance of Counsel for his defence. 


article vii 

3n Suits at common bw, where the value in controversy 
shill exceed twenty dollar*, the right of trial by jury 
shall be preserved, and no fact tried by a jury shall be 
otherwise reexamined in any Court of the United States* 
than according to the rules of the common bw. 

Sltticlt viii 

Excessive bail shall not be required, nor excessive fines 
imposed, nor cruel and unusual punishment inflicted. 



article X 

Xu powers not delegated to the United States by the 
Constitution, nor prohibited by it to the States, are re- 
served to the States respectively, or to the people. 




• Why "[e]ncryption is an altogether different beast" 
under the law, and why that scares the government. 





"In several major hacker cases, the 
subjects have encrypted computer files, 
thereby concealing evidence of serious 
crimes. In one such case, the government 
was unable to determine the full scope of 
the hacker's activity because of the use of 

encryption." 

PREPARED STATEMENT OF ROBERT S. LITT, 
DEPUTY ASSISTANT ATTORNEY GENERAL, 
CRIMINAL DIVISION, DEPARTMENT OF JUSTICE 
SECURITY AND FREEDOM THROUGH ENCRYPTION 

(SAFE) ACT 

MARCH 20. 1997 HOUSE JUDICIARY SUBCOMMITTEE 
ON COURTS AND INTELLECTUAL PROPERTY 
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Where the Wild Things Are," by Maurice Sendak 






Governments fear encryption will allow the 
"Four Horsemen of the Infocalypse (software 

pirates, organised crime, child 
pornographers, and terrorists)" to thwart 

prosecution. 


TERM " I N F O C A LY P S E " : CORY DOCTOROW, "CRYPTO WARS REDUX: WHY 
THE FBI'S DESIRE TO UNLOCK YOUR PRIVATE LIFE MUST BE RESISTED" 



SOMETHING TO THINK ABOUT. 


As encryption becomes more user friendly and 
more widely implemented, how will the 
government seek to weaken it or control its 

implementation? 


Under the law, could they and should they be 

successful in doing so? 



"The new issue may be a Fifth Amendment question rather 
than a Fourth Amendment debate. 'Encryption is an 
altogether different beast. In most cases involving 
encryption, police already possess the device containing the 
encrypted data; the problem is that they cannot read the 
data.' F]orcing an arrestee to reveal an encryption key 
may impinge on a defendant's right against self- 
incrimination. In contrast to the Fourth Amendment warrant 
exception, 'the privilege against self-incrimination has no 

warrant exception.' 

UNITED STATES V. LUSTIG, 13CR392 1-BEN, 2014 WL 
940502 (S.D. CAL. MAR. 11, 2014)(JUDGE ROGER T. 

BENITEZ QUOTING HON. BRIAN M. HOFFSTADT) 



"In other words, future cell phones may 
automatically encrypt user data. If police cannot 
decipher the contents of the phone, whether saved 
in a Faraday bag or not, the only solution may be 
to gain the encryption key from the arrestee. To 
do that, prosecutors could be forced to grant the 
arrestee immunity. '[T]he privilege against self- 
incrimination could well put encrypted data forever 
beyond the reach of law enforcement/" 

UNITED STATES V. LUSTIG, 13CR392 1-BEN, 2014 WL 
940502 (S.D. CAL. MAR. 11, 2014)(JUDGE ROGER T. 
BENITEZ QUOTING HON. BRIAN M. HOFFSTADT) 





HISTORY 


Encryption used by few 

Tools not built in 

Not available on all 
devices 

Tools were flawed, hard 
to use, or implement 

• Ahem. ..Cough. ..PGP 


(TS//SI//REL) Did you know that ubiquitous encryption 
on the Internet is a major threat to NSA's ability to 
prosecute digital-network intelligence (DNI) traffic or 
[ defeat adversary malware? 

I (TS//SI//REL) Twenty years ago, the fact that 
communications were encrypted meant they were very 
likely to contain foreign intelligence, because only 
governments or other important targets had the resources 
to purchase or develop and implement encrypted 

• communications. Today, anyone who uses the Internet can 
access web pages via the strong commercial encryption 

? provided by HTTPS, and companies of all sizes can 
implement virtual private networks (VPN) to permit their 
employees to access sensitive or proprietary company 

* data securely via an Internet connection from anywhere 
. in the world. SID refers to this widespread encryption, 

which poses great challenges to SIGINT, as "ubiquitous 
> encryption." 


Source: Der Spiegel, 

"Prying Eyes: Inside the NSA's War on Internet Security" 


GIZMODO 


+ FOLLOW 


Google Follows Apple in Encrypting Phone 
Data by Default 


O Chris Mills 

Filed to: GOOGLE 9/18/14 8:36pr 




Apple 


ars technica 



A MAIN MENU * MY STORIES: 6 * FORUMS 


JOBS 


INFINITE LOOP THE APPLE ECOSYSTEM 


Apple expands data encryption under iOS 8, 
making handover to cops moot 

"Apple cannot bypass your passcode and therefore cannot access this data." 


by Cyrus Farlvar - Sept 17 2014, 1 1 :57pm CDT 


I? Share I# Tweet I 335 


Apple defies FBI and offers encryption 
by default on new operating system 

New version of Mac OS X will encrypt users' hard drives unless they explicitly 
decline, in spite of pleas by the FBI not to 






2- 1 always password protect my phone. 



Strongly disagree 7% (32 Votes) 
Disagree 10% (46 Votes) 

Neutral 5% (22 Votes) 

Agree 1 6% (77 Votes) 

Strongly agree 63% (303 Votes) 


4- 1 would use encryption if it were easy to use 
and implement. 




Strongly disagree 2% (10 votes) 
Disagree 2 % (10 Votes) 

Neutral 7% (3S votes) 


3- 1 use disk encryption on my computer. 



Strongly disagree 9% (44 Votes) 
Disagree 20% (97 Votes) 

Neutral 1 5% (72 votes) 

Agree 19%(91 votes) 

Strongly agree 37% (176 Votes) 


65 . 8 % 





ENCRYPTION BY DEFAULT 


MacOS 10.10 Yosemite 


Linux (not by default but prompted to enable when 
installing Linux distribution of choice) 




Chrome OS 






x 



iOS8 

Android 5.0 Lollipop 


OS X Yosemite 




The Federalist Society 

for Law dr Public Policy Studies 
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The Conning War Ove 

Intellectual Property Practice Grc 
Issue 1, Spring 1998 

By Eric Vance 



Technology i cybertimes OrSfeHtti! 


□Overview 


Key Stories 


Legislation 


Key Players 


Opinions 


Links and 
Resources 


Talk 


Site Index I Site Search 


Forums 


Archives I Marl 


January 28, 2000 



Deciphering Encryption 

By Dan Froomkin 
Washingtonpost.com Staff 
and Amy Branson 
LEGI SLATE News Service 
Updated May 8, 1998 

The very same data- scrambling technology 
that can let you send your credit card 
number across the Internet without a qualm 
or e-mail a friend in absolute privacy may 
also make it harder for law enforcement 
authorities to detect terrorist plots or build 
cases against criminals. 

Due to recent developments in software 
and hardware, some consumer- level 
encryption products arc now so powerful that law enforcement 
officials say they can’t crack them, even with massive 
supercomputers. 


a 


Top Stories 

• U.S. to Relax Encryption 
Limits (Washington Post, 
Sept. 17) 

• Harry and Louise Have a 
New Worry: Encryption 
(Washington Post, July 28) 


JOURNAL By CARL S. KAPLAN gzei I 

Wrinkle in Mitnick Case Hints at 
Encryption Battles to Come 

A little-known legal skirmish in the case of the computer hacker 
Kevin Mitnick was a preview of similar fights to come as 
more people use encryption software to protect their files, lawyers 
who were involved in the case say. 


Mitnick left federal prison last week after 
serving nearly five years for a scries of 
crimes involving computer fraud and wire 
fraud. But his lawyers say they arc still 
troubled by the judge's answer to a legal 
question raised early in the case: When 
federal agents seize encrypted files from a 
defendant, can they refuse to return them 
unless the defendant turns over the secret 
"key” to decode the files? 


the hottest hi-tech issues on Capitol 
her the government should step in and 
i products to maintain law 
to eavesdrop electronically on anyone 

ryption 

ent 













"Congress shall make no law . . . 
abridging the freedom of 

speech . . . 
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• U.S. regulations prevented the export of encryption 
technologies with strong encryption, defined as 
encryption using keys of 56 bits or larger. 


• 1992, and was gradually eased until 2000 



"5 Essential Privacy Tools For The Next Crypto War 11 
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• "Because computer source code is an expressive means for the 
exchange of information and ideas about computer programming, 
we hold that it is protected by the First Amendment." Junger v. 

Daley, 209 F.3d 481, 485 (6th Cir. 2000) 

• "We conclude that encryption software, in its source code . . . 
must be viewed as expressive for First Amendment purposes, 

and thus is entitled to the protections of [the First Amendment]." 

Bernstein v. U.S. Dep't of Justice, 176 F.3d 1132, 1141 (9th Cir.) reh'g granted, opinion withdrawn, 192 
F.3d 1308 (9th Cir. 1999) 

• "[B]ecause the regulations apply to encryption source code, it 
necessarily follows that the regulations burden a particular form 

of expression directly." Bernstein v. U.S. Dep't of Justice, 176 F.3d 1132, 1142 (9th Cir.), 




"The right of the people to be secure in 
their persons, houses, papers, and 
effects, against unreasonable searches 
and seizures . . . and no Warrants shall 
issue, but upon probable cause, 
supported by Oath or affirmation, and 
particularly describing the place to 
be searched, and the persons or 

things to be seized." 


(c) 1963 "Where the Wild Things Are," by Maurice Sendak 



4TH AMENDMENT 

IS ABOUT 

LAWFUL ACCESS 



Not a search 


• Informants or coconspirators who wear a wire 

• False friends - those lovely friends who take what you tell them and tell the police, 
not under the direction of the police. 

• Private actors 

• Undercover officers 

• Phone company, Internet, or other company (3rd Party Doctrine) 

• Trash: No reasonable expectation of privacy in garbage because assumption of 
risk for bums, animals, kids, and other rummaging. 

• Consent 
Plain view 


Border Search 



Probable cause to believe 


A crime has been or is being committed AND 


• That the items subject to seizure by virtue of their 


connect to the crime. 



(c) 1963 "Where the Wild Thinqs Are," bv Maurice Sendak 


Irecta 


06 Inicia sessio 
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PROBABLE 

CAUSE 


• Does the use of encryption 
play a role in the probable 
cause or reasonable 
suspicion analysis? 



Subscriu-fhil 


El jutge Gomez Bermudez 
envia a la pres6 set de les onze 
persones detlngudes durant 
I'operacio Pandora 

L'us del servidor Riseup.net o la lectura del 
llibre 'Contra la democracia' son dos dels 
indicis emprats a la interlocutoria per 
justificar el seu empresonament 


Four of the detainees have been released, but seven have been jailed pending trial. The reasons given by the judge for 
their continued detention include the posession of certain books, "the production of publications and forms of 
communication", and the fact that the defendants "used emails with extreme security measures, such as the RISE UP 
server” 2 . 


No major caselaw. Possible area to watch 








ENCRYPTION IS ONLY 
FOR THOSE WHO HAVE 
SOMETHING TO HIDE. 

Strongly Disagree Disagree Neutral Agree 



A CRYPTO MERD'S 

HIS LAPTOPS ENCRYPTtO. 

lets su/lo a miuiom-pouar. 

CLUSTER to CRACK \T 


I NO GOOD 1 . IT'S 

\ «40% -BIT RSA\ 

BLAST’ OCR 1 



WHAT WOULD 

actually happen ; 

H’S LAPTOP'S ENCRYPTED. 
DRUG HIM AND HTT HIM WITH 
THIS $5 WRENCH UNTIL 

HE TELLS US THE password. 



http://xkcd.com/538/ 







"[N]o person . . . shall be compelled 
in any criminal case to be a witness 
against himself [or herself.]" 



5TH AMENDMENT PRIVILEGE 
AGAINST SELF-INCRIMINATION 


AKA: 

• "I plead the 5th." 

• "On counsel's advice, I invoke my 
right under the Fifth Amendment 
not to answer, on the grounds I 
may incriminate myself." 

BUT: 

(c) the Simpsons, Season 2, Ep. 31 

• What about my "right to remain 
silent"?(Miranda) 




But these phrases are not magic! Invoking 

the privilege does not mean 

automatic and absolute protection. 




PROTECTION 


Protects and individua (not a corporation) 

"from compulsory incrimination through his own 
testimony or personal records ." 

Can be asserted any time. 

"[C]an be asserted in any proceeding, civil or 
criminal, administrative or judicial, investigatory 

or adjudicatory," Kastigar v. United States, 406 U.S. 441, 445 (1972) 



SIMPLY, FOR THE 
PRIVILEGE TO APPLY 
THERE MUST BE: 

1. COMPULSION 

2. SELF-INCRIMINATION 

3. TESTIMONIAL 
COMMUNICATION OR ACT 



p 

u 



By government 

• Court Order 

• Grand Jury 



SELF-INCRIM 



INATING 


• Answer given: 

• supports a conviction, or 

• provides a link in the 
chain of evidence that 
might lead to 
incriminating evidence 

• do not have to be guilty 
to invoke privilege. 


"The privilege protects the innocent as well as the guilty." 



"[0]ne of the Fifth Amendment's basic functions is 
to protect innocent persons who might otherwise 

be ensnared bv ambiauous circumstances." 


OHIO V. REINER, 532 U.S. 1 7 (2001) 





A self-incriminating statement can be 
just a statement that tends to increase 
the danger that the person making the 
statement will be accused, charged, or 

prosecuted 



TESTIMONIAL = REVEALS THE 
CONTENTS OF YOUR MIND 


Oral Statements: revea 
something that only 
exists within the 
individual's mind 

Actions: a bit more 
difficult... 



(c) Touchstone Pictures, "Signs" 


"[Defendant's statement as to the 
password was testimonial in nature." 

U.S. V. ROGOZIN, NO. 09-CR-379 (S)(M), 2010 WL 

4628520 (W.D.N.Y NOV. 16, 2010) 



TESTIMONIAL ACT 


Providing blood samples, finger prints, voice samples, 
and writing samples are NON-testimonial and thus 
NOT protected. 

When does an act reveal the contents of your mind? 

• Usually arises in document production . 

Government can compel if merely a physical act 
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ACT-OF-PRODUCTION DOCTRINE 


• Producing documents has communicative aspects 

• Implicitly communicates statements of fact. 

• Individual admits by producing documents: 

1 . documents exist 

2. they are authentic 

3. they are in the individual's possession or control 



PROBLEM: 

ACT-OF-PRODUCTION DOCTRINE 
IS INSANELY FACT SPECIFIC 



F GOVERNMENT: 


can show with "reasonable particularity" that 
when it sought to compel production that they 
already knew the materials sought existed 
(forgone conclusion); 

gathers the information another way; or 

grants immunity 


NO TESTIMONIAL ACT 



OBTAINING 
INFORMATION 
ANOTHER WAY 

• Other evidence 

• Bypassing security 

• Backdoor, brute force etc. 



IMMUNITY 


Then no longer 
incriminating. 




FORGONE CONCLUSION/ 
REASONABLE PARTICULARITY 


• Demonstrated by testimony by third party that individual 

possesses the documents 

• Individual being subpoenaed acknowledged that the 

documents existed and were in his or her possession 

• Have evidence that indicates the subpoenaed documents 
already exist and are in the individuals possession 

• documents are the type that exist in the course of doing 
business (narrowed slightly). 



ACT-OF-PRODUCTION DOCTRINE 


• Producing documents has communicative aspects 

• Implicitly communicates statements of fact. 

• Individual admits by producing documents: 

1 . documents exist 

2. they are authentic 

3. they are in the individual's possession or control. 




PLEASE TELL ME MY ENCRYPTED 

DATA ISN'T ALWAYS A FOREGONE 

\ 

CONCLUSION! \ 


SUDO GIVE ME YOUR PASSPHRASE 


• Only a few courts have examined whether or not 
individual's Fifth Amendment right against self- 
incrimination completely protects forced disclosure of 
a password, encryption key, or decrypted version of 
the documents. 


Where the courts differ: FOREGONE CONCLUSION 



Whether or not the 5th Amendment 
privilege against self-incrimination 
applies in forced decryption cases 
depends on if the evidence revealed 
through turning over a password or 
decrypted documents is a forgone 

conclusion. 



Any self-incriminating testimony that he may have 
provided by revealing the password was already a 
"foregone conclusion" because the Government 
independently proved that Gavegnano was the 
sole user and possessor of the computer. 

U.S. V. GAVEGNANO, 305 FED.APPX. 954, 956 (4TH CIR. 

2009) 



r H E C A S L S : 

• Commonwealth v. Gelfgatt, 468 Mass. 512 (2014) 

• In re The Decryption of a Seized Data Storage System (Feldman), 13-M-449 (E.D. 
Wis. 2013) 

• In re Grand Jury Subpoena Duces Tecum (Doe), 670 F. 3d 1335 (1 1th Cir. 2012) 

• United States v. Fricosu, 841 F. Supp. 2d 1232 (D. Colo. 2012) 

• United States v. Kirschner, 823 F. Supp. 2d 665 (E.D. Mich. 2010) 

• U.S. v. Rogozin, No. 09-CR-379 (S)(M), 201 0 WL 4628520 (W.D.N.Y Nov. 16, 2010) 

• U.S. v. Gavegano, 305 Fed.Appx. 954 (4th Cir. 2009) 

• In re Boucher, No. 2:06-mj-91, 2009 WL 424718 (D. Vt. Feb. 19, 2009) 
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GIZMODO 


+ FOLLOW 



Adam Clark Estes 

Filed to: PRIVACY 12/01/14 12:2- 


36,239 £ 3 ^ 



Gives federal courts authority to issue writs 
(court orders) that are "necessary or 
appropriate in aid of their respective 
jurisdictions and agreeable to the usages 
and principles of law/' 

Requires 3rd parties to assist in execution of 
prior court order 



• Cannot use to 
bypass 

Constitutional 

rights 

• Cannot use if 
"unreasonably 
burdensome" 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLORADO 
Judge Robert E. Blackburn 


Crm nai Case No 1 0-cr 00509 REB 02 
UNITED STATES OF AMERICA. 

Plaint *f. 
v. 

2 RAMONA CAMELIA FRlCOSU. 
a/Va Ramona Sm th, 

Dofondant 

ORDER GRANTING APPLICATION UNDER THE ALL WRITS 
ACT REQUIRING DEFENDANT FRlCOSU TO ASSIST IN THE 
EXECUTION OF PREVIOUSLY ISSUEO SEARCH WARRANTS 

Blackburn, J. 

Tho majors be'oro me are (1) the government s Application Under the All 
Writs Act Requiring Defendant Fricosu To Assist in the Execution of Previously 
Issued Search Warrants (#1 1 1] filed May 6 201 1 and (2) Ms. Fricosu's Motion for 
Discovery - Seized Hard Drive [*101J Mod April 27. 2011. I held hearings on those 
motions on November 1. 201 1. and January 3 2012. at which I received evidence and 
argument 

In fashioning my ruling. I have considered all relevant adjudicative facts m the file 


and record of this case I have considered the evidence educed at the hearings on 







(c) 1963 "Where the Wild Things Are," by Maurice Sehdak 












LEGISLATION FOR MANDATED 
BACKDOOR 


Constitutional 



All Writs Act DOES NOT give thi: 
authority 


do ov 

ETT 


• "unreasonably burdensome" 

• UNLESS backdoor already exists 
Currently, unlikely to happen. 



House Representatives Darrell Issa, 
Zoe Lofgren, Senator Ron Wyden say 
"zero chance" they will pass a bill 
forcing companies to install backdoor 
access in device encryption for federal 

investigators. 



INTELLIGENCE 




5. (TS//SI) The fact that NSA/CSS makes 
cryptographic modifications to commercial 


TOP SECRET// 
COMINT 



TOP SECRET//COMINT//REL USA. AUS, CAN, GBR, NZl 

Happy Dance!! 




exploitation is unrealistic 

DECRYPTS, DECRYPTS, DECRYPTS!!!!!! 



ENCRYPTION SHOULD BE 
TURNED ON BY DEFAULT 


Strongly Disagree Disagree Neutral 

0 Strongly Agree 



Agree 


22% 




• Biggest Split: 

• Question 12: The government should be 
able to force an individual to decrypt 
personal information under the proper lega 
measures (a warrant or court order). 

17% 

31 % 

52 % 


52.2% - Disagree 
31 .61% - Agree 
17.19%- Neutral 



AGREE VS. DISAGREE 


Agree = more casual about privacy rights/ 
protections 

Almost all believe in fundamental right to privacy 
— but not necessarily with respect to privacy 
rights from the government. 

Disagree = More likely to use disk encryption or 
password protect phone 

Both disagree that encryption is ONLY for those 
who have something to hide. 




If the police have lawful access, but no 
technological access. Should technologica 
access barriers always defeat legal access 

barriers? 



WHAT'S NEXT? 


MORE ENCRYPTION! 

ESTABLISHED 5TH AMENDMENT CASELAW 
BIOMETRIC VS. PASSPHRASE 

LEGAL DEBATE ABOUT BALANCE 

CONTINUED TO BE WORKED OUT IN COU.RTS 
WILL FOREGONE CONCLUSION BE ENOUGH? * 

PROBABLE CAUSE 

LES.S LIKELY TO FACTOR INTO ANALYSIS AS IT 
BECOMES INCREDIBLY PREVALENT 


(c) 1963 "Where the Wild Things Are 



aurice Sendak 


• The Shmoo Group & ShmooCon 

• The University of Illinois Urbana-Champaign 

• Masooda Bashir & Boyi Guo 

Questions? 

@wbm312 . 




(c) 1963 "Where the Wild Things Are," by Maurice Sendak 


